A description will now be given of related art.
FIG. 56 is a diagram illustrating the configuration and operation of a related data conversion apparatus.
As shown in FIG. 56, the data conversion apparatus for block cipher consists of a key generator 20 and a data scrambler 30.
The key generator 20 is a key generation unit that generates a key for data encryption/decryption.
The data scrambler 30 is a unit that encrypts and decrypts input data.
The key generator 20 consists of an intermediate key generator 40 and a key scheduler 210. The intermediate key generator 40 is a unit that receives a secret key and generates an intermediate key (Key KL) and an output key (Key KA) based on the secret key received. The key scheduler 210 that receives the intermediate keys (Key KL) and the output keys (Key KA) generated at the intermediate key generator 40 (Key KLL, Key KLH, Key KAL, and Key KAH), and schedules a key to be fed to the data scrambler 30 among the inputted keys. Thus, in the key generator 20, keys are generated and scheduled at the intermediate key generator 40 and the key scheduler 210, respectively.
The data scrambler 30, upon receipt of P (plaintext), performs a data conversion of the data for encryption, and then outputs converted data as C (ciphertext). Upon receipt of P (ciphertext), on the other hand, the data scrambler 30 performs a data conversion of the data for data decryption, and then outputs converted data as C (deciphertext). The data scrambler 30 thus performs the data encryption process and the data decryption process.
In the data scrambler 30, a main converter 320 and a sub converter 330 are connected in series.
The main converter 320 is a unit that performs nonlinear conversion. More particularly, the main converter 320 is provided with an F function that performs nonlinear data conversion for one round or multiple rounds, or a part of the F function, and performs a nonlinear conversion of data using the F function or the part of the F function. FIG. 57 shows the main converter 320 that is provided with the F function for one or more rounds.
The sub converter 330 is provided with at least one of a data converter unit (FL) performing a linear conversion of data and a data inverter unit (FL−1) performing a conversion that is inverse to the conversion performed by the data converter unit, and makes a linear conversion of input data using an input key by means of the data converter unit (FL) or the data inverter unit (FL−1).
The selector 310 is a selector that selects one signal out of the input signals of the main converter 320, the sub converter 330, P (plaintext or ciphertext) and a key. The selector 310 shown in FIG. 56 is provided with a selector that selects one signal out of four input signals, which is equivalent to three 2-1 selectors, each of which outputs one output signal out of two input signals.
The arithmetic register 350 is a memory that holds data that is outputted as the main converter 320, the sub converter 330 and C (ciphertext or deciphertext) for a predetermined period of time.
Thus, the data scrambler 30 encrypts/decrypts the input data P (plaintext or ciphertext) through repetitions of nonlinear conversion by the main converter 320 and the linear conversion by the sub converter 330 several times alternately, and then outputs C (ciphertext or deciphertext).
A description will now be given of the internal configuration of the main converter 320.
FIG. 57 shows the internal configuration of the main converter 320. The main converter 320 of FIG. 57 is made up with six F function units. Assuming here that each of the F function units is configured with a circuit that is designed for a one-round F function process, the main converter 320 of FIG. 57 is then to perform the F function based nonlinear data conversion for six rounds.
With respect to the circuit for the six-round F function process, the main converter 320 may be provided with six F function process circuits, or otherwise a single F function process circuit with repetitions of the F function process six times to end up achieving the six-round F function based data processing.
At the main converter 320, upper data divided of input data is inputted to an F function unit 321a first. A key 1 that was scheduled by the key scheduler 210 is also inputted thereto. At the F function unit 321a, the upper input data is nonlinear converted by use of the key as aforementioned. At an EXOR circuit 322a, the data nonlinear converted is XORed with the lower input data. Data outputted from the EXOR circuit 322a is inputted to an F function unit 321b. The F function unit 321b, like the F function unit 321a, performs the nonlinear conversion, and converted data is then XORed with the upper input data at an EXOR circuit 322b. Data outputted from the EXOR circuit 322b is inputted to an F function unit 321c. In this manner, the same process as that performed by the F function unit 321a and the EXOR circuit 322a is performed by the F function unit 321b and the EXOR circuit 322b, by the F function unit 321c and an EXOR circuit 322c, by an F function unit 321d and an EXOR circuit 322d, by an F function unit 321e and an EXOR circuit 322e, and by an F function unit 321f and an EXOR circuit 322f, respectively. Thus, the six-round F function based nonlinear conversion is performed (or the one-round F function based nonlinear data conversion is repeated six times) in that manner, and then converted data is outputted.
The structure for the process of nonlinear conversion aforementioned is called a FEISTEL structure, which is characterized in that the upper data and the lower data are swapped and outputted by receiving one of upper data divided and lower data divided, nonlinear converting data received, outputting one of the upper data and the lower data converted, XORing between one of the upper data and the lower data outputted and the other one of the upper data and the lower data, swapping XORed data and the other one of the upper data and the lower data that was not inputted to the F function unit, and outputting the lower data and the upper data swapped.
Typical structures for data randomization are FEISTEL structure and SPN (Substitution Permutation Network) structure. The main converter 320 with the SPN structure is said to excel in parallel processing. With the FEISTEL structure, the main converter 320 is said to excel in hardware downsizing.
Note that the SPN structure, unlike the FEISTEL structure in which input data is divided, is structured such that an F function made up of an S layer (nonlinear layer) and a P layer (linear layer) is repeated.
A description will now be given of the internal structure of the sub converter 330.
FIG. 58 is a diagram illustrating circuits that make up the sub converter 330.
The sub converter 330 of FIG. 58 is provided with a data converter unit 50 and a data inverter unit 70.
In the data converter unit 50, a logical AND operation is performed between the upper 32-bit data of 64-bit input data and a key 1 at an AND circuit 54, a result of which is then subject to rotation shift by one bit to the left. Then, at an EXOR circuit 55, an input is XORed with the lower 32 bits of the input data, a result of which is outputted as a lower 32-bit output signal and also inputted to an OR circuit 57. Then, at the OR circuit 57, an input is subject to a logical OR operation with a key 2, a result of which is then XORed with the upper 32-bit data of the input data at an EXOR circuit 56, a result of which is outputted as an upper 32-bit output signal. In this manner, the 64-bit input data is linear converted and then outputted as a 64-bit output signal.
In the data inverter unit 70, a logical OR operation is performed between the lower 32-bit data of 64-bit input data and a key 3 at an OR circuit 74, a result of which is then XORed with the upper 32 bits of the input data at an EXOR circuit 75, a result of which is outputted as an upper 32-bit output signal and also inputted to an AND circuit 77. At the AND circuit 77, an input is subject to a logical AND operation with a key 4, a result of which is then subject to rotation shift by one bit to the left. Then, at an EXOR circuit 76, an input is XORed with the lower 32-bit data of the input data, a result of which is outputted as a lower 32-bit output signal. In this manner, the 64-bit input data is liner converted at the data converter unit 50 and the data inverter unit 70, and then outputted as a 64-bit output signal. Note that the key 1 through the key 4 are fed by the key scheduler 210.
FIG. 59 is a diagram showing a circuit shared by the data converter unit 50 and the data inverter unit 70 as an example of the sub converter 330.
With FIG. 59, when a switching signal for switching between the data converter unit 50 and the data inverter unit 70 is inputted, the data converter unit 50 and the data inverter unit 70 are switched. More specifically, in the shared circuit of FIG. 59 when receiving the switching signal, a 2-1 selector 99a switches between an input signal A and an input signal E, and a 2-1 selector 99b switches between an input signal C and an input signal F.
A description will be given of the case in which the shared circuit acts as the data converter unit 50 first.
The 2-1 selector 99a selects the input signal A out of the input signal E and the input signal A, and outputs the signal as an output signal B. Then, at an AND circuit 101, an input is subject to a logical AND operation with the key 1, a result of which is then subject to rotation shift by one bit to the left. Then, at an EXOR circuit 91, an input is XORed with the lower 32 bits of the input data, a result of which is outputted as a lower 32-bit output signal, and also inputted to the 2-1 selector 99b as the input signal C. The 2-1 selector 99b selects the input signal C out of the input signal C and the input signal F, and outputs the signal C as an output signal D. Then, at an OR circuit 92, a logical OR operation is performed between the output signal D and a key 2, a result of which is then XORed with the upper 32-bit data of the input data at an EXOR circuit 93, a result of which is then outputted as an upper 32-bit output signal.
A description will then be given of the case in which the shared circuit acts as the data inverter unit 70.
The 2-1 selector 99b selects the input signal F out of the input signal C and the input signal F, and outputs the input signal F as the output signal D. Then, the OR circuit 92 performs a logical OR operation between the output signal D and the key 2, a result of which is XORed with the upper 32 bits of the input data at the EXOR circuit 93, a result of which is outputted as an upper 32-bit output signal, and also inputted to the 2-1 selector 99a as the input signal E. The 2-1 selector 99a selects the input signal E out of the input signal A and the input signal E, and outputs the input signal E as the output signal B. Then, at the AND circuit 101, a logical OR operation is performed between the output signal B and the key 1, a result of which is then subject to rotation shift by one bit to the left, a result of which is then XORed with the lower 32 bits of the input data at the EXOR circuit 91, a result of which is outputted as a lower 32-bit output signal.
FIG. 60, in contrast with the data conversion apparatus of FIG. 56, is a diagram illustrating a data conversion apparatus in which the main converter 320 is provided with ½x(x≧1) F function, which is designed for processing the F function for less than one round.
In the case where the main converter 320 is provided with ½ F function, for example, a two-cycle process may be performed by way of the path from the main converter 320 through the sub converter 330, the selector 310, the arithmetic register 350, then back to the main converter 320. This allows one round of F function based nonlinear data conversion process to be accomplished. To implement such a process, the data conversion apparatus of FIG. 60, in contrast with the converter of FIG. 56, is added with the path from the arithmetic register 350 to the selector 310.
A description will now be given of the operation of the main converter 320 by way of the path from the arithmetic register 350 to the selector 310.
FIG. 61 illustrates the internal configuration of the main converter 320.
As shown in FIG. 61, the main converter 320 is made up of 12 F function units, each of which processes the F function for less than one round, e.g., ½ of the F function (½ F function). The main converter 320 of FIG. 61 performs data conversion using an F function unit 1321a, an F function unit 1321b, an EXOR circuit 1322a, and an EXOR circuit 1322b, while the main converter 320 of FIG. 57 performs the same data conversion using the F function unit 321a and the EXOR circuit 322a. 
With reference to the main converter 320 of FIG. 61, the first round process will be explained first. Upper data divided from the upper input data is inputted to the F function unit 1321a. A key 1H, which is made up of the upper bits of the key 1 scheduled by the key scheduler 210, is also inputted to the F function unit 1321a. The F function unit 1321a nonlinear converts the upper data using the key 1H. Then, converted data is inputted to the EXOR circuit 1322a, and is XORed with the upper data divided from the lower input data.
Data outputted from the EXOR circuit 1322a is held in the arithmetic register 350 as intermediate data until a data processing is done in the EXOR circuit 1322b. 
Then, a second round process will be explained. From the upper input data, the lower data divided is inputted to the F function unit 1321b. A key 1L, which is made up of the lower bits of the key 1 scheduled by the key scheduler 210, is also inputted to the F function unit 1321b. The F function unit 1321b performs a nonlinear conversion of the lower data using the key 1L. Then, converted data is inputted to the EXOR circuit 1322b. 
Now, the intermediate data, which is the output data from the EXOR circuit 1322a and held in the arithmetic register 350, is to be inputted to the EXOR circuit 1322b. Then, the path from the arithmetic register 350 to the selector 310 is needed. More specifically, the path from the arithmetic register 350 to the selector 310 allows inputting the intermediate data held in the arithmetic register 350 to the selector 310. The selector 310 selects the intermediate data received. The intermediate data is then inputted to the main converter 320 via the arithmetic register 350, and then XORed with output data from the F function unit 1321b by the EXOR circuit 1322b. Output data from the EXOR circuit 1322b is inputted to the F function 1321c. 
In this manner, the same process as that performed by the F function unit 1321a, the EXOR circuit 1322a, the F function unit 1321b, and the EXOR circuit 1322b is performed by an F function unit 1321c, an EXOR circuit 1322c, an F function unit 1321d, and an EXOR circuit 1322d, by an F function unit 1321e, an EXOR circuit 1322e, an F function unit 1321f, and an EXOR circuit 1322f, by an F function unit 1321g, an EXOR circuit 1322g, an F function unit 1321h, and an EXOR circuit 1322h, by an F function unit 1321i, an EXOR circuit 1322i, an F function unit 1321j, and an EXOR circuit 1322j, and by an F function unit 1321k, an EXOR circuit 1322k, an F function unit 1321l, and an EXOR circuit 1322l, respectively. After thus processing the 12-round nonlinear data conversion by the F function units (or repeating 12 times), converted data is outputted.
Problem 1.
With reference to the data conversion apparatuses of FIG. 56 and FIG. 60, the key generator 20 uses part of the main converter 320 and part of the sub converter 330 so as to generate a key used for data encryption/decryption. The purpose of using part of the main converter 320 and part of the sub converter 330 is to reduce the total size of the data conversion apparatus.
With this key generating operation discussed later in detail, in order to generate a key thus using part of the main converter 320 and part of the sub converter 330, a path is needed to input the intermediate key (Key KL) outputted from the key KL register 240 into the selector 310 as shown in FIG. 56. This increase of the path from the key KL register 240 to the selector 310 is a cause of preventing the data conversion apparatus from getting smaller.
This also increases the number of input signals to the selector 310 by way of the path from the key KL register 240 to the selector 310, which causes an increase in the number of selectors consisting of the selector 310. This is another cause of preventing the data conversion apparatus from getting smaller.
As aforementioned, the one-round F function based data conversion in two or more cycles is accompanied by the need of inputting the intermediate data held for a given period of time into the main converter 320. This increase of the path to transfer the intermediate data from the arithmetic register 350 to the selector 310 is still another cause of preventing the data conversion apparatus from getting smaller.
Additionally, the increase in the number of input signals to the selector 310 by way of the path from the arithmetic register 350 to the selector 310 causes an increase in the number of selectors consisting of the selector 310. This is still another cause of preventing the data conversion apparatus from getting smaller.
Problem 2.
With reference to the data scramblers 30 of the data conversion apparatuses shown in FIG. 56 and FIG. 60, the main converter 320 and the sub converter 330 are connected in series. This determines the operation frequency uniquely by the path from the main converter 320 through the sub converter 330, the selector 310, the arithmetic register 350 then back to the main converter 320, which prevents the operation frequency from being improved. Therefore, it has been a desire to increase the operation frequency by making a maximum path for data processing shorter in the data scrambler 30, thereby improving the throughput speed remarkably. Additionally, there is no path provided which allows data outputted from the selector 310 and then the arithmetic register 350 to go into the sub converter 330 without passing through the main converter 320. Therefore, a flexible response is not allowed to a change in the internal configuration of the data conversion apparatus, which results in little flexibility in the overall operation.
As aforementioned, in the case where the one-round F function based data conversion is performed in two or more cycles, it is part of input data (½ of the input data with ½ F function) that is converted in one cycle. This requires the path in the data scrambler 30 to transfer converted data of the part of input data to the arithmetic register 350 to be held therein and then transfer the converted data to the sub converter 330 after a given period of time. Or otherwise, the transfer path is required in the main converter 320 to transfer the converted data to the sub converter 330 passing through the main converter 320 after a given period of time.
Additionally, with the circuit shared by the data converter unit 50 and the data inverter unit 70 shown in FIG. 59, the path A→B→C→D→E→B→C . . . corresponds to a loop circuit. This requires the shared circuit designed not to become a transmission circuit in practical implementation when affected by signal racing caused by differences in the propagation delay of switching signals, noise, etc. Another problem is that logic synthetic tools are not applicable to such a circuit having a loop circuit (FEEDBACK-LOOP circuit), and therefore logic synthesis cannot be achieved efficiently.
It is an object of the present invention to downsize a data conversion apparatus.
It is another object of the present invention to improve the operation frequency of a data conversion apparatus.